CVE-2026-54657

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54657

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54657.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54657

Aliases

GHSA-f29q-7rpr-jmjx

Published

2026-10-16T15:21:57Z

Modified

2026-10-28T02:31:06Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

Details

Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can therefore retrieve case or document metadata outside the token's authorized types or confidentiality levels. Document searches require known UUIDs, and document content remains protected by separate download authorization. This issue is fixed in versions 1.27.2, 1.28.2, and 1.29.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285",
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54657.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "1.0.0"
                        },
                        {
                            "fixed":  "1.27.2"
                        },
                        {
                            "introduced":  "1.28.0"
                        },
                        {
                            "fixed":  "1.28.2"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StringRangeExpression"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "1.27.2"
                        }
                    ],
                    "source":  "DESCRIPTION"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/open-zaak/open-zaak

Affected ranges

Type

GIT

Repo

https://github.com/open-zaak/open-zaak

Events

Introduced

Fixed

15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd

Fixed

4b429d3243d1532f6fe731f932a201cf0ddc4c18

Fixed

d3869af98c60570782f867bab3e1d14fd8d8330f

Fixed

19d59a923cf9e59d4f424cde42f4d22967b1d9b3

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "15456f1a0ef4b0abf1b1c0e3a16c99c15423b9fd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "4b429d3243d1532f6fe731f932a201cf0ddc4c18"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "d3869af98c60570782f867bab3e1d14fd8d8330f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "1.29.0",
            "range":  [
                {
                    "fixed":  "19d59a923cf9e59d4f424cde42f4d22967b1d9b3"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.9.0

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.1.1

1.10.0

1.10.1

1.11.0

1.12.0

1.12.1

1.13.0

1.13.0-archief.0

1.14.0

1.15.0

1.16.0

1.2.0

1.22.0-alpha.0-perftest

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.4.0

1.5.0

1.6.0

1.7.0

1.7.1

1.8.0

1.8.1

1.8.2-performance-fixes

zgw-consumers-1.*

zgw-consumers-1.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54657.json"